CVE-2025-15115 is an authentication bypass vulnerability in Petlibrio Smart Pet Feeder Platform (<=1.7.31). The issue arises from improper OAuth token validation in the social login system, specifically at the /member/auth/thirdLogin endpoint. Attackers can send crafted requests with arbitrary Google IDs and phoneBrand parameters to obtain valid session tokens without authenticating, thereby gaining unauthorized access to user accounts. The platform is cloud-hosted, and the vendor manages remediation for this service.

Successful exploitation allows unauthenticated attackers to fully access any user account on the platform, potentially leading to unauthorized control over smart pet feeder functions and exposure of user data. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and low to low integrity and availability impacts.

The vendor manages remediation for this cloud-hosted service and has made a patch available. Users and administrators should verify with the vendor advisory that the platform is updated or the service is patched server-side. No additional action is required if the vendor confirms mitigation.